Last Wednesday at 11 PM, my own client group chat roasted me
I tried 4 times—every prompt said "please use the device you registered with." That's when it hit me: my clients' account keys were locked inside my old iPhone.
That's the cost of Passkey (most folks call it "fingerprint login" or "face login")—it ties you to one device, one vendor. I was trying to save time, so I switched Notion, Figma, and two clients' banking dashboards over to Passkey. Result: switching phones, onboarding an intern, trying to log in on an Android tablet for a quick task—everything got blocked.
(I also messed this up—last month I was helping my Xiaohongshu (Little Red Book) friend Alin migrate her account. She wanted to move from iPhone to a Xiaomi, and we spent 5 hours digging through the old phone turning off Passkeys one at a time.)
What Passkey actually is, and who's already using it
Plain English: Passkey replaces your regular password with "fingerprint / face / lock screen PIN." Apple, Google, and Microsoft are all pushing it. Notion, GitHub, LinkedIn, and plenty of banking dashboards already support it.
But for small teams and personal brands like us, a few traps hit hard:
1. The key travels with the device. New phone = move everything, then you discover a few you forgot to move.
2. It doesn't cross vendors. Apple Passkey doesn't play nice on Android, and the other way around is the same.
3. Team sharing is painful. Letting an intern use my Figma means either handing her my phone, or disabling Passkey and falling back to passwords—so what's the point?
Plenty of people are raising the alarm. Security researcher Nicholas Weaver wrote a long warning about this months ago; a recent thread got 300+ upvotes and 300+ comments, almost all grumbling "switch devices and it falls apart."
The cost of replicating this "convenience" today
- Money: $0 (built into the OS)
- Time: 5–10 minutes per account
- Tech barrier: basically zero—just set up a fingerprint or face
- First step (if you want to test it): phone Settings → "Passwords" or "Security" → "Passkeys" → pick a low-stakes account to try
(Already locked out? Don't ditch the old phone yet—log into every account from it, turn off Passkey, switch back to a password.)
Don't feel pressured to try this now—Passkey isn't for everyone. Traditional passwords + a password manager (1Password, Bitwarden) are more stable for most of our use cases.
What I actually do now
- Just starting out (solo): if you're brand new, I'd say stick with classic passwords + 1Password / Bitwarden. Free tier handles 20 accounts easily. Turn on Passkey only when you truly need it.
- 1–2 clients (starting to share stuff): if you need to share with clients, I'd say set up a 1Password shared vault, use long passwords, and turn on 2FA. Skip Passkey for now—unless you and your clients all use the same phone brand.
- Scaling up (team of 3+): if you're already scaling, I'd say jump straight to a business password manager (1Password Teams / Bitwarden Teams—few bucks per person per month), plus a hardware key like YubiKey. Hold off on Passkey until cross-vendor support actually works.
One last thing: this is a hole I personally fell into, not a verdict that Passkey is forever broken. But for "switch devices anytime, add people, jump between tools"—the kind of small team we are—the current cost is higher than the convenience. The day Apple, Google, and Microsoft actually make it cross-vendor, we can switch then.
